# DF-5540 — uark(4) cfg-chain synchronous-EP0 stall (ucom family)

**File:** `sys/bus/u4b/serial/uark.c` (Arkmicro ARK3116 USB-RS232; ucom core)
**Class:** cfg-stall family (cf. DF-5367 ufoma / DF-5383 umcs / DF-5407 uplcom
/ DF-5421 uchcom / DF-5424 uftdi / DF-5425 uslcom / DF-5449 uvscom / DF-5456
umoscom / DF-5476 ubsa / DF-5487 uvisor / DF-5496 umct / DF-5504 ucycom;
root occupancy-gating mechanism DF-5532)
**Evidence class:** KLD-harness-with-production-code (no Arkmicro ARK3116 USB
device model exists on the QEMU guest; the harness drives the real in-kernel
`usb_process` taskqueue machinery that ucom's cfg callbacks, synchronous
close and detach drain run on, with uark's exact production request counts
and the production 1000 ms timeout).

## Build (on the guest)

```
sh build.sh     # cd /usr/src/sys/bus/u4b/serial/ua5540 && make
                # artifact: uark5540stall.ko  (-Werror clean)
```

## Run (on the guest)

```
sh run.sh       # dmesg -c; kldload /root/df5540/uark5540stall.ko (~25 s,
                # all phases at MOD_LOAD); kldunload; dmesg | grep UA5540
```

## Expected decisive output (measured 2026-10-07)

```
UA5540[A]: closer: unblocked  ELAPSED=921 ms   (first open: 1-request
            break-off line-state task -- ONLY set_break is registered
            among uark's line callbacks; param bails !LL_READY)
UA5540[2]: closer: unblocked  ELAPSED=6995 ms  (+ 1 tcsetattr: 6 reqs
            + hz/10 pause = 6.1 s -- heaviest single-rate chain in the
            audited family short of umcs' 28-request open/close)
UA5540[3]: closer: unblocked  ELAPSED=13012 ms (+ burst of 5 tcsetattr
            coalesced to 2 param executions — production msignal
            double-buffer ceiling; a paced/sustained loop extends
            without bound until the abuser stops)
UA5540[B]: closer: unblocked  ELAPSED=2029 ms  (fix#1: abort on error)
UA5540[C]: closer: unblocked  ELAPSED=561 ms   (fix#1+#2: abort+250 ms)
```

Every simulated request sleeps its full ~980–1000 ms (absolute timestamps
in run.log), i.e. each is the real in-kernel cost of an unanswered EP0
data/status stage. Stability re-run (run.2.log): 854 / 6950 / 12963 /
2034 / 564 ms.

## Fix validation

`fix.diff` (6 hunks): error-returning `uark_cfg_write()`, chain aborts in
`uark_cfg_param()` (all 6 steps checked), bounded cfg-path timeout
1000 → 250 ms (`UARK_CFG_TIMEOUT`). Applies 6/6 clean (`git apply
--check` on the audit tree + guest `patch -p1`) and the patched
production `uark.ko` compiles with zero compiler diagnostics
(`fix_compile.log`; the only "error" string in build logs is the literal
`-Werror` flag).

## Artifacts

- `uark5540stall_harness.c` — the rig (self-contained KLD)
- `Makefile`, `build.sh`, `run.sh` — exact build/run
- `build.log` / `run.log` / `run.2.log` / `fix_compile.log` — full untrimmed logs
- `env.txt` — guest uname/compiler
- `fix.diff` — git-apply-able unified diff (never applied to `sys/`)
- `VERDICT.md` — full narrative; `manifest.json` + `verdict.json`